Network comprising a plurality of network nodes for media access checks

ABSTRACT

The invention relates to a network comprising a plurality of intercoupled network nodes. Controlled by a bus guardian the network nodes transmit messages during a respectively assigned time slot and receive messages from other network nodes outside this time slot. Each network node comprises a test signal generator which delivers a test signal outside the respectively assigned time slot, and includes a test signal detector which detects outside the respective time slot, after receiving a test signal from at least another network node, that there is a defective circuit portion in the assigned network node and/or in at least another network node.

The invention relates to a network comprising a plurality of networknodes. Such networks may be installed, for example, in motor vehicles,in industrial automation (sensor systems) and domestic automation (forexample, lighting, alarm systems, heating system, air-conditioningsystem etc.).

In such a network for motor vehicles can be used, for example, the TTPprotocol (TTP=Time-Triggered Protocol) known from the periodical“Elektronik”, no. 14, 1999, pp. 36 to 43 (Dr. Stefan Polenda, GeorgKroiss: “TTP: “Drive by Wire” in greifbarer Nähe”). This protocol makesa reliable data transmission possible and may therefore also be used innetworks concerning security-relevant devices (for example brakes). Saidarticle mentions a bus system as a network structure.

It is an object of the invention to provide a different networkcomprising a plurality of network nodes.

The object is achieved by a network of the type defined in the openingparagraph, in that the network nodes, controlled by a respective busguardian, send messages during an assigned time slot and receivemessages outside this time slot, in that each network node contains atest signal generator which delivers a test signal outside the assignedtime slot, and in that each network node contains a test signal detectorwhich, after receiving a test signal from at least another network nodeoutside the time slot, detects that there is a defective circuit portionin the assigned network node and/or in at least another network node.

The invention relates to the use of the network in security-relevantapplications. For protecting the network against the failure of a node,a check mechanism is inserted for the transmission of messages betweenthe network nodes. This check mechanism is referred to as a media accesscheck and checks, for example, whether a network node sends at the wronginstant or even continuously. A bus guardian in a network node controlsthe media access. This bus guardian makes it possible, when capable ofoperating, that the network node can send a message only during apredefined or assigned time slot.

The individual network nodes may be coupled via twisted-pair metalliccables. For example, a bus or star structure may then be used.

During the time not used for the actual transmission of messages, a testsignal is then briefly transmitted from one test signal generator toother network nodes, which test signal, if no errors occur, does noteven reach the other network nodes due to the bus guardian. A testsignal detector then checks whether the transmitted test signal returnsto the network node. If it does, the bus guardian may be defective. Inthis way, the media access is checked in a simple manner with only atest signal without additional line expenditure (cable or opticalconductor) between the network nodes.

As defined in claim 2, with a control unit evaluating the detectionresults can not only be evaluated the operability of the bus guardian inthe assigned network node, but also the operability of other networknodes.

If a circuit portion (for example, bus guardian) in a network node hasbroken down, this is detected by the assigned control unit and theoutput of the network node is blocked (claim 3). This blocking can berealized, for example, by deactivating a switchable amplifier at theoutput of the network node.

Claim 4 shows a method of establishing whether a test signal generatoris defective. Claim 5 describes a network comprising a plurality ofnetwork nodes and a star node in a star structure, in which networkmessages are transmitted by means of a pilot signal. The pilot signal isgenerated by a pilot signal generator as defined in claim 6. The pilotsignal generator may then also perform the function of test signalgenerator (claim 7). The test signal detector may also be provided forthe detection of the pilot signal generated during the assigned timeslot (claim 7).

The invention also relates to a network node in a network comprising aplurality of further intercoupled network nodes.

Examples of embodiment of the invention will be further explained withreference to the Figures. In the drawings:

FIG. 1 shows a network in a star structure comprising a plurality ofnetwork nodes which are coupled via an active star node,

FIG. 2 shows a first embodiment of a star interface in a star node,

FIG. 3 shows a first embodiment of a first star node,

FIG. 4 shows part of a network node with a pilot signal generator,

FIG. 5 shows part of a waveform of two signals in the network,

FIG. 6 shows a second embodiment of a star interface in a star node,

FIG. 7 shows a second embodiment of a first star node and

FIG. 8 shows a state transition diagram for a control unit included inFIG. 4.

An example of embodiment of a network in a star structure is shown inFIG. 1. This network contains, for example, four network nodes 1 to 4,which are intercoupled via an active star node 9 through twisted-pairline pairs 5 to 8 provided for a symmetrical signal transmission. Theactive star node 9 performs a line adaptation, so that the line pairs 5to 8 in the active star node 9 are terminated by a wave resistor, anddetects a pilot signal transmitted by a network node 1 to 4. If the linepairs 5 to 8 were interconnected without the active star node 9, therewould be a mismatch in the star point for each line pair as a result ofthe impedance jump from Z₀ to ⅓Z₀, which is caused by the fact that therespective other line pairs are connected in parallel. For generating apilot signal, each network node 1 to 4 further includes a pilot signalgenerator.

It is also possible to couple the active star node 9 and the networknodes 1 to 4 via optical waveguides. In that case the star node 9 andthe network nodes 1 to 4 are to include opto-electrical orelectro-optical converters respectively, at the ends of the opticalwaveguides.

The active star node 9 contains for each line pair 5 to 8 a starinterface which enables a transfer of the messages from a transmittingnetwork node to all the other network nodes connected to the active starnode. An example of embodiment of such a star interface is shown in FIG.2. A line pair 5 to 8 is connected to the inputs of a switchableamplifier 10, to the outputs of a further switchable amplifier 11, to apilot signal detector 12 and to a terminal resistor 13. The resistanceof the terminal resistor 13 corresponds to the wave resistance and istherefore used for the correct line termination. When the pilot signaldetector 12 detects a pilot signal, it generates a release signal whichis led to a switch input 14 of the switchable amplifier 10, to aninverting input of an AND gate 15 and, via an amplifier 17 and a line18, to an OR gate 23 (FIG. 3). When the switchable amplifier 10 has beenreleased, it supplies data to a data line 19 which leads to a connectnode. This data line 19 also receives data from the other starinterfaces and transfers them via the switchable amplifier 11 to theassigned line pair. Via a line 20 the non-inverting input of the ANDgate 15 is further supplied with a release signal through the OR gate23, which release signal is produced by another star interface (FIG. 3).The non-inverting output of the AND gate 15 is connected to a switchinput 21 of the switchable amplifier 11 and, via an inverter 16, to arelease input 22 of the pilot signal detector.

A switchable amplifier 10 or 11 may also be arranged as a seriescombination of amplifier and switch (switch element). When this switchis closed, the output signal of the amplifier is transferred.

The pilot signal detector detects whether the assigned network nodeshows, by transmitting the pilot signal, that it intends to transmitmessages or data respectively. If this is the case, the amplifier 11 isdeactivated (generally it will already have reached this state) and theamplifier 10 is activated or released respectively. The message signalcoming from the assigned line pair is led to the line 19 and transferredthere to the other star interfaces. Additionally, the release signalgenerated by the pilot signal detector 12 signals to the other starinterfaces that they should activate or release their respectiveamplifier 11 for transferring the messages to the respective assignednetwork nodes.

As shown in FIG. 3, the lines 18 of all the other star interfaces arecombined in the OR gate 23 FIG. 3 further shows four star interfaces 24to 27, which are coupled to the line pairs 5 to 8 respectively. Theoutput of the OR gate 23 is connected to the lines 20 (FIG. 2) of thestar interfaces 24 to 27. Lines 19 (FIG. 2) of each star interface 24 to27 are combined via a circuit node 28.

To avoid a signal coming from a line pair 5 to 8 being returned to thesame pair, the amplifier 11 is deactivated or switched off via theinverting input of the AND gate 15. On the other hand, to avoid thepilot signal detector assigned to another network node activating itsown amplifier 10, the release signal transported over the line 20 (FIG.2) is used via AND gate 15 and inverter 16 to suppress the releasesignal for the pilot signal detector 12. This also switches off ordeactivates the amplifier 10 via its switch input 14. The pilot signaldetector 12, whose pilot signal causes the assigned star interface toreceive data, however, remains active for detecting the end of the datatransmission.

For the perfect functioning of the active star node 9 it is necessarythat the network nodes 1 to 4 transmit their messages not overlappingwith time. In addition, it is to be ensured that for the duration of acertain dead time no network node is active or transmits messages ordata, respectively. In this state the star node is fully blocked (i.e.all the amplifiers 10 and 11 are deactivated). In this state a starinterface 24 to 27 in the star node 9 waits for a new pilot signal, bywhich a request for transmitting messages is indicated.

Basically, it holds that the pilot signal is always to be transmittedahead of the beginning of the transmission of the actual message. Onlythen will be ensured that the active star node 9 is configured in timeand that also the beginning of the message reaches all the other networknodes.

FIG. 4 shows in what manner the pilot signal is generated in a networknode 1 to 4 and transmitted over a line pair 5 to 8. When a network nodewishes to transmit a message or data to other network nodes, a pilotsignal generator 29 receives for example a start signal over a line 30.The pilot signal generator 29 then delivers a pilot signal to amultiplexer 31 to which data to be transmitted are supplied via a line32. The signal produced by the multiplexer 31 is applied to the assignedline pair via an amplifier 32. A signal originating from another networknode is led by the line pair via an amplifier 34 onto a line 35 to befurther processed.

The multiplexer shown in FIG. 4 may then be arranged both as a timemultiplexer (transmission of the pilot signal as a start and a stopsignal each time before and after the actual message), or as a frequencymultiplexer. This means that the pilot signal may accompany either as acontinuous signal the whole message to be transmitted, or can betransmitted in the form of a start and stop signal. For example, as aresult of different durations, there may be ensured that the start andstop signal are sufficiently distinguished and the change betweentransmission time and transmission pause is not mixed up.

The pilot signal may be generated in various ways. One possibility isthat it may be a periodic signal, whose frequency range lies outside thefrequency range used for the transmission of the messages. Thisfrequency range may lie above or below the useful frequency band, butalso lie in “gaps” due to the narrow-band type of the pilot signal whenthe effective frequency band is specified correspondingly. A furtherpossibility is to transmit the actual message as a symmetrical push-pullsignal and the pilot signal as an in-phase signal. The in-phase signalmay be in the form of a constant voltage, but also in the form of aperiodic signal. A third possibility for the pilot signal is that it isrealized in the form of special symbols put before or after thetransmitted message.

The network is particularly suitable for use in networks operatingaccording to the TTP protocol for a real-time communication, forexample, in a motor vehicle (compare Elektronik, vol. 14/1999: “TTP:“Drive by Wire” in greifbarer Nähe” pp. 36 to 43). With this protocolthere is determined, on the one hand, when which transmitter is allowedto transmit with the aid of a conflict-free TDMA access method(TDMA=time-division multiple access) and, on the other hand, a dead time(interframe gap) is defined in which no transmitter is allowed totransmit. This mechanism immediately guarantees that the active starnode 9 always goes back to the state of rest. Thus the TDMA methodguarantees that always only one network node is allowed to transmit amessage at a predefined time and, for this purpose, by means of thepilot signal transmitted by it, activates or causes to activate in thestar node the star interface assigned thereto to transfer messages.

An additional advantage is that for controlling the so-called busguardian, a control signal is to be present in the network node, whichsignal lies shortly before the beginning of the transmission of themessage. This control signal may be used immediately for controlling thepilot signal generator 29 in that this control signal is applied to thepilot signal generator over the line 30.

In FIG. 5 this control signal is referred to as BG and the actualmessage is referred to as data. The control signal BG is, for example,in a low state during the transmission of the message. During this lowstate of the control signal the message is to be transmitted. A firsttime space T1, after a change of the control signal to the low state,and a second time space T2, before a change of the control signal to thehigh state, are then to be selected, so that the active star node 9 isand continues to be configured correctly for the flawless transmissionof the message. It is still to be observed that the TTP protocolsupports different (constant) message delay times between variousnetwork nodes in the network. So doing, the delay time caused by theactive star node 9 does not violate the TTP protocol.

The network according to the invention enables the transmission of apilot signal with any type of signal transmission of messages from anetwork node 1 to 4. For example, for the transmission of messages asymmetrical push-pull transmission, single line transmission or carrierfrequency-modulated transmission can be selected. With an in-phasecoupling of the line pairs 5 to 8 a supply voltage could be transmitted,for example, together with a message.

In lieu of the OR gate 23 required in FIG. 3, this OR combination mayalso be realized directly by a wired OR combination. A star interfacesuitable for the wired OR combination is shown in FIG. 6. This starinterface as shown in FIG. 6 is identical with the star interface ofFIG. 2 except for the switched combination of the output of theamplifier 17. In FIG. 8 the output of the amplifier 17 does not lead tothe line 18, but to the line 20 (wired-OR). This provides that theoutput of the amplifier 17 is connected to the inverting input of theAND gate 15. The amplifier 17 is realized in FIG. 2 as a push-pullamplifier and in FIG. 6 as an open-collector or open-drain amplifier,respectively.

As a result of this wired-OR combination, the cost of wiring is reducedand the OR gate 23 is omitted from the active star node 9 and thenetwork can easily be extended by further network nodes as a result ofthe omission of the OR gate, which is otherwise to be maintained in somevariants. The star interfaces 24 to 27 are in this case connected to therespective lines 19 and 20, so that, as a result, they form two circuitnodes 47 and 48 as shown in FIG. 7. Only one resistor 49 is additionallyto be provided, which is coupled, on the one hand, to the circuit node47 and, on the other, to a supply voltage. Together with the amplifiers17 of each star interface, this resistor forms the wired-OR combination.

When the network is used in security-relevant applications, anadditional control mechanism for the transmission of messages betweenthe network nodes 1 to 4 (media access) is to be inserted to protect thenetwork against the breakdown of a node. More particularly a failure ina way that a node sends at the wrong time or even continuously mustcertainly be avoided. According to the invention, the failure of thecontrol mechanism in the case of media access is recognized in that fora time not used for the actual transmission of messages a brief,specific violation of the media access rules is faked and thus thefunctioning of the additional media access control to be describedhereinafter (in the case of TTP/C the bus guardian) can be checked. Inthe time not used for the actual message transmission, a signal isbriefly supplied for transmission over a line pair 5 to 8, which signaldoes not even reach the network if there are no errors, due to theadditional media access control (by means of the bus guardian).

The check is made in that, for example, after the actual time slot forthe transmission of messages has elapsed, a test signal is transmittedand simultaneously a check is made whether this test signal appears on aline pair. As an instant for the transmission of the test signal may beused, for example, the dead time between the transmission of themessages from various network nodes (between the TDMA time slots).

For realizing this check the circuit portion (FIG. 4) that is providedfor generating the pilot signals includes a bus guardian 50, a testsignal generator 51, a test signal detector 52 and a control unit 53.The test signal generator 51 delivers a test signal to the multiplexer31 when this multiplexer 31 receives a release signal from the controlunit 53 over a line 54. The test signal is delivered to the line pairvia the multiplexer 31 and the amplifier 33. The multiplexer 31 alsoapplies this test signal to the test signal detector 52. The test signaldetector 52 has a further connection to the output line 35 of theamplifier 34. The test signal detector 52 delivers the result of thedetection to the control unit 53 via lines 55. The control unit 53delivers to the associated network node status information about a line56 and a further signal about a line 57 to the amplifier 33 which isarranged as a switchable amplifier. Furthermore, a signal is fed to theamplifier 33 by the bus guardian 50. The amplifier 33 is switched on oractivated only when both the bus guardian 50 and the control unit 53produce signals for activating the amplifier 33.

The control unit 53 causes the test signal generator 51 shown in FIG. 4to send the test signal for a previously defined period of time afterthe end of the time slot for the transmission of messages.Simultaneously, the control unit 53 activates its release signal 57 forthe amplifier 33. The test signal detector 52 connected to the amplifier34 in the receiving branch produces the result of the detection whichindicates the presence of the test signal in the output signal of theamplifier 34 to the control unit 53 over the lines 55. The result of thedetection of the self-test is signaled to the assigned network node inthe form of a status signal over lines 56. If the test signal isrecognized during the self-test phase in the receiving branch, an errorhas occurred and the amplifier 33 is permanently deactivated. Otherwise,no error shows up. To ensure that the test signal generator 51 alsoreally generates a test signal, the test signal is also applied to thetest signal detector 52 to be checked.

Since the bus guardian is to permit access only during the predefinedtime slot, the recognition of a test signal on the line pair outside thepredefined time slot may be interpreted as an abnormal behavior of themedia access controller. By deactivating the amplifier 33 it is avoidedthat a continuously transmitting network node blocks the star node 9when the bus guardian has not recognized the error.

The control unit 53 may be arranged, for example, as a state machine,which is supplied with power by its own clock generator. The informationabout when the access to the medium is allowed or when the predefinedtime slot for the transmission of the message occurs, is received by thecontrol unit 53 from the assigned network node, which is not shown indetail in FIG. 4. Thus the control unit 53 can perform the media accesscheck independently of the bus guardian. Particularly the case where theclock generator of the bus guardian fails and the bus guardian thereforeuninterruptedly allows access to the media, may certainly be recognizedin this manner. An embodiment of a state transition diagram of thecontrol unit 53 is shown in FIG. 8.

The state transition diagram of FIG. 8 shows an output state AZ, whichchanges to a send phase SP when the bus guardian 50 and the control unit53 activate the switchable amplifier 33 and thus the time slot fortransmitting a message from the assigned network node begins. Thecontrol unit 53 only supplies a deactivation signal to the amplifierwhen an error has occurred. When the time slot ends, a change to thetest phase is made and a test signal is briefly sent by the test signalgenerator 51.

If the test signal detector 52 recognizes the test signal on the outputof the multiplexer 31 and detects a not allowed test signal on the line35, there is an error, which is featured by state F in FIG. 8. If thecontrol unit 53 no longer detects a test signal from the test signaldetector 52 after it has switched off the test signal (over line 54),there is an internal error (bus guardian defective), which is shown bythe status IF. The control unit shows this error as status informationand deactivates the amplifier 33 over the line 57.

If the test signal generator 51 is defective, the test signal detector52 does not detect a test signal on the output of the multiplexer 31. Ifthe test signal detector 52 additionally detects a not allowed testsignal on the line 35, there is an external error, which is shown inFIG. 8 by the status EF. A test signal is then detected, although notest signal is generated any longer. This test signal comes from anotherdefective network node.

From status F a transition is made to status EF when the test signaldetector 52 (test signal generator 51 is switched off) no longerrecognizes a test signal on the output of the multiplexer 31 and when anot allowed test signal is detected on the line 35. This means that thetest signal generator 51 functions correctly and another network node isdefective.

When the test signal generator 51 is defective, the test signal detector52 detects during the test phase that there is no test signal on theoutput of the multiplexer 31. If no test signal occurs on line 35 either(no external error), status TF is changed to. From this status TF areturn cannot be made to the output status. The status of the busguardian can no longer be detected.

If during the test phase TP a test signal has been detected on theoutput of the multiplexer 31 and no test signal on the line 35, there isan error. This features status FF. After the statuses IF, EF and FF areshown, a return is made to the output status AZ.

In lieu of a test signal it is also possible to use the pilot tone as atest signal. Then it is also possible to recognize the transmission of acontinuous pilot tone. In lieu of the test signal generator 51, thepilot signal generator 29 may be used in that case for transmitting thepilot tone as a test signal. The test signal generator 51 may be omittedin that case.

Basically, the test signal may be transmitted at arbitrary instants,that is, immediately before or after the time slot for the transmissionof messages, or at an arbitrary other instant in the dead time betweentime slots.

A further use comprises that also during the time slot for thetransmission of messages there may be checked whether the pilot tonenecessary for releasing the star interface is generated correctly. Thisadditional check renders the error diagnosis easier, because adistinction may be made between a defective connector line and defectivepilot tone generator.

1. A network comprising a plurality of intercoupled network nodes,characterized in that the network nodes, controlled by a respective busguardian, send messages during an assigned time slot and receivemessages outside this time slot, in that each network node contains atest signal generator which delivers a test signal outside the assignedtime slot, and in that each network node contains a test signal detectorwhich, after receiving a test signal from at least another network nodeoutside the time slot, detects that there is a defective circuit portionin the assigned network node and/or in at least another network node,the test signal detector is also provided for directly receiving thetest signal of the assigned test signal generator and in that a controlunit in a network node receives and evaluates the detection results ofthe test signal detector and establishes that a circuit portion in theassigned network node is defective when only during the assigned timeslot the assigned test signal generator and another network node delivera test signal and establishes that a circuit portion in at least anothernetwork node is defective when during the assigned and the other timeslot at least another network node delivers a test signal.
 2. A networkas claimed in claim 1, characterized in that the control unit blocks theoutput of the network node in case of a defective circuit portion in theassigned network node.
 3. A network as claimed in claim 1, characterizedin that the control unit in a network node establishes that the assignedtest signal generator is defective when during the assigned and theother time slot a test signal is delivered neither by the assigned testsignal generator nor by another network node.
 4. A network comprising aplurality of intercoupled network nodes, characterized in that thenetwork nodes, controlled by a respective bus guardian, send messagesduring an assigned time slot and receive messages outside this timeslot, in that each network node contains a test signal generator whichdelivers a test signal outside the assigned time slot, and in that eachnetwork node contains a test signal detector which, after receiving atest signal from at least another network node outside the time slot,detects that there is a defective circuit portion in the assignednetwork node and/or in at least another network node, in that at leastpart of the network nodes are directly intercoupled via at least onestar node, in that the star node comprises a plurality of starinterfaces which are assigned to at least one network node, in that arespective star interface in dependence on a pilot signal transfers amessage from the assigned network node to the other star interfaces orfrom another star interface to at least one of the assigned networknodes, in that more than one star interface are assigned to at least onenetwork node, of which only one interface transfers messages independence on the status of the assigned network node.
 5. A network asclaimed in claim 4, characterized in that each network node includes apilot signal generator which generates either a pilot signal whichindicates the whole assigned time slot or the beginning and end of thetime slot.
 6. A network as claimed in claim 5, characterized in that thepilot signal generator is also used as a test signal generator.
 7. Anetwork as claimed in claim 4, characterized in that the test signaldetector also detects the pilot signal generated during the assignedtime slot.